Privacy policy

Thank you for visiting the official website of Vasil Levski Sofia Airport!

From 20 April 2021 SOF Connect AD, UIC 206155179, with seat of business and registered office: Sofia 1540, № 1 Christopher Columbu” Blvd. is the licensed airport operator of the largest international airport in the Republic of Bulgaria.

Processing of personal data

Personal data means any information relating to a natural person that can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors.

As a data controller, SOF Connect AD complies with all the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data („GDPR“) by collecting and processing only personal data to the extent necessary for the provision of the services we offer and the economic activity carried out and keeping it in a responsible and lawful manner under restricted access.

For contact with the Data Protection Officer (“DPO”):

SOF Connect AD

Sofia 1540, Christopher Columbus Blvd 1,

еmail: dpo@sof-connect.com

This Privacy Policy explains how we collect and use your personal data, what your rights are, and provides information on what to expect when SOF Connect AD processes personal data.

Whether you are using our website, carrying out a point-of-sale charge or other services that require a pass while you are on Sofia Airport premises, whether you are a passenger, accompanying person, customer, passing through the public or restricted areas of the airport, using any of our services, receiving press releases and marketing materials, making an enquiry, being our employee or a potential employee, you are entrusting us with your data so that we can provide the services and information you expect.

Personal data we collect

SOF Connect AD processes various types of personal data. This includes information you provide to us, information we create, or information that is provided by a third party or publicly available source. For more details about the personal data we process and how that data is collected or obtained, see the table below.

Data categories	Description	Personal data source
Identity data	Name, date of birth, PIN, address, signature	This information is provided by you depending on which of our services you use.
Contact details	Email, phone	This information is provided by you depending on which of our services you use.
Flight information	Flight number, flight date, lounge	This information is provided by you depending on which of our services you use.
Vehicle data	Vehicle registration number, entry and exit time intervals	This information is provided by you when booking parking lot at Terminal 1 or Terminal 2, also when parking in the terminal car parks and when passing through the Restricted Area (Kiss and Ride). Information on the registration numbers of taxi companies in the territory of the Sofia Municipality is collected from the public register under Article 12, paragraph 4 of the Road Transport Act and can be updated by representative organisations of the industry.
Financial data	Details of payments made and accounting/tax documents issued	This information is provided by you depending on which of our services you use.
Social media – accounts	Social media username and if your account is public, we will also receive information about your profile, such as the content you provide, followers of posts, following, comments on your profile, biography and address for your online presence.	This information is provided by you when you use the social networks on which SOF Connect AD has authorised profiles or pages. When you interact with our social channels your personal data may be processed.
Video recording	Images recorded through video surveillance	We will record your image if you visit a location where CCTV is being carried out (both public and restricted locations).
Data about services	Records of products and services you have used. This includes details of our lounges.	This information is provided by you and some of it is generated by us after you use our services.
History of contacts with us	Details of each enquiry in chronological order, complaint or request you have made to SOF Connect AD and may include copies of correspondence.	You provide us with this information when you contact us to make an enquiry, make a complaint or report.
Online Identifiers	IP address, etc.	This information is collected automatically when you visit our website.
Temporary pass details (“With companion” or “Unaccompanied”) for any of the Sofia Airport access areas	1. first, middle and last names; 2. PIN/ID; 3. place of birth; 4. nationality; 5. mobile phone; 6. address; 7. Position at the legal entity submitting the application; 8. Details of the employment/civil contract of the person to whom the pass is issued (date, for a period of); 9. employment reference, to the extent permitted by law; 10. specimen of the authorised person; 11. What activity the person will be performing; 12. Where in the security zones the activity will be conducted;	The information is provided directly by you or your employer. The absence of some of the information may result in the pass being refused.
When issuing a temporary vehicle pass	1. a vehicle registration number; 2. brand; 3. model; 4. users of the vehicle; 5. name and signature of the authorised person on the specimen;	The information is provided directly by you or your employer. The lack of some of the information may result in the pass being refused.

How do we process your personal data?

Purpose	Legal basis for processing
Provision of the parking reservation service at Terminal 1 or Terminal 2	Taking steps at the request of the data subject before entering into a contract.
Provision of parking service in the terminal car parks and passing through the Restricted Area (Kiss and Ride)	Performance of a contract
Management of the access rule to the Restricted Access Zone for taxi carriers registered in the public register under Article 12, paragraph 4 of the Road Transport Act on the territory of Sofia Municipality.	Legitimate interest
To process payments and issue accounting/tax documents (invoices) in relation to services used.	Performance of a contract and legal obligation
To receive and process a request to visit one of our passenger lounges.	To take steps at the request of the data subject before entering into a contract, performance of a contract to which the data subject is a party.
To receive and respond to online form for comments and recommendations that are related to criticism (complaint, signal), baggage complaint, praise, question, suggestion.	Legitimate interest – we may need to process your data in order to respond to any query, complaint or request raised by you or another person.
To issue a temporary pass for a person or vehicle	Legal obligation
Crime prevention and detection – including the use of CCTV to protect passengers, our staff and property. To maintain the safety and security of Sofia Airport for our passengers, employees and stakeholders including, but not limited to, air traffic control, national security, crime detection and prevention and aviation security.	Legal obligation – airport and civil aviation security under the National Civil Aviation Security Programme.
Support the effective management of Sofia Airport operations and any incidents.	Legitimate interests – we sometimes need to process personal data to protect the rights, property and personal safety of our employees and property.
For communication through the social media channels of SOF Connect AD	Legitimate interests – we use social media such as Twitter, Facebook, Instagram, YouTube, LinkedIn to interact with our customers. When we receive enquiries on these social media platforms, we may collect your personal information so that we can correctly identify you and deal with your enquiry. All personal information collected will depend on the information you provide to us. In some cases, we may request additional information to help us deal with your enquiry.

With whom do we share your personal data?

SOF Connect AD only discloses personal data to third parties and recipients if they have a legal basis to receive it. The categories of recipients are determined on a case-by-case basis according to their legal basis for receiving the data, which may be:

State bodies in accordance with their powers, e.g. bodies of the Ministry of the Interior, State Agency National Security, Customs Agency, etc.
Banks with a view to paying amounts due.
Providers of postal and courier services for addressing correspondence.

How long do we keep your personal data?

We store your data in accordance with the various applicable regulations and legal retention periods, proportionate to the processing purposes set out above.

Transfer of personal data to a third country

If a transfer of personal data outside the European Union is necessary, this will take place in full compliance with the conditions set out in Chapter V of the GDPR.

What are your rights?

As a data subject, you have the following rights:

Information right – you have the right to know what data will be processed for what purposes and on what basis.
Right of access – You have the right to access your personal data and details of how we process it.
Right to rectification – You have the right to correct personal data about you if it is inaccurate or incomplete.
Right to object –You have the right to object to the use of personal data, such as direct marketing. Individuals also have the right to object to the processing of personal data on the basis of legitimate interests or for the performance of a task carried out in the public interest.
Right to erasure –You have the right to request us to erase or remove personal data from our records where there is no legitimate reason for us to continue processing it. Where personal data is still necessary for legitimate interests, it will not be possible to delete that data, so some requests may be refused.
Right of data portability – where personal data are processed by automated processes based on consent or contract. For this purpose, the data shall be transmitted in a structured, commonly used and machine-readable format.
Right to restriction of processing – You have the right to “block” the processing of personal data in limited circumstances. This right may apply:

If the accuracy of your personal data needs to be checked;
If the legal basis for the processing of your personal data is disputed and needs to be reviewed by SOF Connect AD;

If the processing is unlawful but you do not want the personal data to be erased;

If the personal data is no longer needed by SOF Connect AD but you want the data to be retained for the purposes of a legal claim.

Right to withdraw your consent – Where we process your personal data on the basis of your consent, you have the right to withdraw that consent. Withdrawal of consent is effective for the future.
Right to lodge a complaint to a supervisory authority – You can lodge a complaint to the Personal Data Protection Commission, which is the supervisory authority in the Republic of Bulgaria responsible for the implementation of the Personal Data Protection Act and the General Data Protection Regulation, at. 1592 Sofia Blvd. “1595 Prof. kzld@cpdp.bg, website: cpdp.bg.

Is automated decision-making, including profiling, taking place?

Automated decisions are defined as decisions for individuals that are based solely on the automated processing of data and that produce legal effects that significantly affect the individuals concerned. We do not use automated decision making.

How to contact us?

Individuals may contact us to exercise their data protection rights or make other data-related enquiries at the following contacts: